a2b9759904891626c673025ef8bb93f8cb478f578861bba0236e749275b52e52

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_7a235cacb19520bdb101ed18afb742d0_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 539KB
Sample261104-tsrf3adh78
SHA256 a2b9759904891626c673025ef8bb93f8cb478f578861bba0236e749275b52e52
MD5 7a235cacb19520bdb101ed18afb742d0
SHA1 f4059d495a04db6e2f0838f14925d44dd255d5d5
SHA512 b3ee613c4e2f7cd5f4d5b891241941ff4daec3bb075c68f7ac39d6e39066a4789f3059fc4faa5d7bd9af4ca3238140d8e4010eb6a2bfe99b04cf49e1d8ec8b60
SSDEEP 6144:E5emOjTG4Z2cOAw89gzG1cFKxcWbAposLiZ1JcymWncOG+43ITaN461IwppFGqJs:8eTRt+847SJcymJ7I+N71I+vrJs
TLSH
T130C4293A965806BCE1A6C1B9CE864D13E735780E07B169FF17D049A25D2B1E09F3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost.exe	2026-11-03_7a235cacb19520bdb101ed18afb742d0_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost.exe	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2336	svchost.exe
1084	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\CppSvc1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3940	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 2336	3244	2026-11-03_7a235cacb19520bdb101ed18afb742d0_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 2336 wrote to memory of 3940	2336	svchost.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-03_7a235cacb19520bdb101ed18afb742d0_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_7a235cacb19520bdb101ed18afb742d0_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Executes a file named after a Windows system binary
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /F /SC ONLOGON /RL LIMITED /TN "CppSvc1Task" /TR "\"C:\Users\Admin\AppData\Roaming\svchost.exe\""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3940

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
1⤵
- Executes dropped EXE
PID:1084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 539KB
SHA256 a2b9759904891626c673025ef8bb93f8cb478f578861bba0236e749275b52e52
MD5 7a235cacb19520bdb101ed18afb742d0
SHA1 f4059d495a04db6e2f0838f14925d44dd255d5d5
SHA512 b3ee613c4e2f7cd5f4d5b891241941ff4daec3bb075c68f7ac39d6e39066a4789f3059fc4faa5d7bd9af4ca3238140d8e4010eb6a2bfe99b04cf49e1d8ec8b60
SSDEEP 6144:E5emOjTG4Z2cOAw89gzG1cFKxcWbAposLiZ1JcymWncOG+43ITaN461IwppFGqJs:8eTRt+847SJcymJ7I+N71I+vrJs
TLSH
T130C4293A965806BCE1A6C1B9CE864D13E735780E07B169FF17D049A25D2B1E09F3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-4-0x00007FF772A60000-0x00007FF772AEC000-memory.dmp

Download

memory/2336-2-0x00007FF772A60000-0x00007FF772AEC000-memory.dmp

Download

memory/3244-0-0x00007FF6B9920000-0x00007FF6B99AC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads